CVE-2011-4612

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.

icecast antes de v2.3.3 permite a atacantes remotos inyectar caracteres de control, tales como saltos de línea en registro de errores (error.log) a través de una URL maliciosa.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-11-29 CVE Reserved
2012-11-20 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source
https://bugzilla.redhat.com/show_bug.cgi?id=768176	Issue Tracking

URL	Date	SRC

URL	Date	SRC
http://www.icecast.org	2021-09-09

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090668.html	2021-09-09
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090695.html	2021-09-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xiph Search vendor "Xiph"		Icecast Search vendor "Xiph" for product "Icecast"				<= 2.3.2 Search vendor "Xiph" for product "Icecast" and version " <= 2.3.2"		-		Affected